Release 0.11.1

.github/workflows/deploy.yml

@@ -23,12 +23,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           # Disabled to prevent cache poisoning in release workflows
@@ -50,7 +50,7 @@ jobs:
           SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
 
       - name: Upload release asset
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: ${{ github.workspace }}/${{ github.event.repository.name }}.zip
         env:

.github/workflows/e2e-tests.yml

@@ -50,12 +50,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up NodeJS 20
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: npm
@@ -95,7 +95,7 @@ jobs:
 
       - name: Cache Playwright browsers
         id: playwright-cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}

.github/workflows/integration.yml

@@ -48,7 +48,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/js-tests.yml

@@ -40,12 +40,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up NodeJS 20
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: npm
@@ -54,7 +54,7 @@ jobs:
         run: npm ci
 
       - name: Cache ESLint and Jest results
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             .eslintcache

.github/workflows/lockfile-registry.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/php-lint.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -50,7 +50,7 @@ jobs:
           composer-options: --prefer-dist --no-progress
 
       - name: Cache PHPCS results
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .phpcs-cache
           key: phpcs-${{ runner.os }}-${{ hashFiles('.phpcs.xml.dist', 'composer.json') }}-${{ github.sha }}

.github/workflows/wordpress-org-assets.yml

@@ -0,0 +1,42 @@
+name: Update WordPress.org assets and readme
+
+# Pushes the readme and the .wordpress-org assets (icons, banners, screenshots)
+# to the plugin's SVN trunk without cutting a new release. WordPress.org reads
+# "Tested up to", "Requires at least" and "Requires PHP" from trunk, so this is
+# how those compatibility headers are refreshed between releases. Run it manually
+# from the Actions tab after merging a readme or asset change to the default branch.
+on:
+  workflow_dispatch:
+
+# Workflow-level permissions set to none; jobs declare their own minimal permissions
+permissions: {}
+
+# Never interrupt an in-flight SVN commit
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  update:
+    name: Update readme and assets on WordPress.org
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read # Only needs to read the repository to copy the readme and assets
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Update readme and assets
+        uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 # v2.2.0
+        env:
+          SLUG: edit-flow
+          SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
+          SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
+          # This plugin's readme is Markdown (README.md), not the default readme.txt.
+          README_NAME: README.md
+          # Only sync the readme and assets; never re-sync the plugin code to trunk.
+          IGNORE_OTHER_FILES: true

AGENTS.md

@@ -11,7 +11,7 @@ Editorial workflow plugin with custom statuses, editorial comments, and notifica
 | **Function prefix** | `ef_` |
 | **Namespace** | Global (legacy) |
 | **Source directory** | `modules/` |
-| **Version** | 0.11.0 |
+| **Version** | 0.11.1 |
 | **Requires PHP** | 7.4+ |
 | **Requires WP** | 6.4+ |
 

CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.1] - 2026-08-18
+
+A maintenance and compatibility release. It closes an information-disclosure issue in the Editorial Metadata module, corrects calendar date handling, declares compatibility with WordPress 7.1, and takes a batch of dependency updates including several security fixes. All users are encouraged to update.
+
+### Security
+
+* fix: stop editorial metadata leaking to unauthorised REST readers by @GaryJones in [#1036](https://github.com/Automattic/edit-flow/pull/1036)
+
+### Fixed
+
+* fix: keep post_date_gmt in sync when dragging posts on the calendar, and convert the quick-create timestamp to GMT when opted in by @GaryJones in [#1009](https://github.com/Automattic/edit-flow/pull/1009)
+
+### Documentation
+
+* docs: declare compatibility with WordPress 7.1 by @GaryJones in [#1039](https://github.com/Automattic/edit-flow/pull/1039)
+* docs: declare WordPress 7.0 compatibility and add a wp.org asset-update workflow by @GaryJones in [#1007](https://github.com/Automattic/edit-flow/pull/1007)
+
+### Maintenance
+
+* ci: silence two newly-flagged VIPCS sniffs on custom-status code by @GaryJones in [#1037](https://github.com/Automattic/edit-flow/pull/1037)
+* Routine dependency updates for npm packages and GitHub Actions, including security fixes for brace-expansion, axios, postcss, and shell-quote
+
 ## [0.11.0] - 2026-06-10
 
 This release completes the security-review remediation begun in 0.10.4. It resolves the remaining issues from a full audit of the plugin's authenticated code paths — the headline stored XSS in the editorial-metadata location field, two information-disclosure issues (the iCal feed and the Story Budget), and a long tail of defence-in-depth hardening across access control, input handling, deserialisation, output escaping, and client-side code. None are known to be exploited in the wild, but all users are encouraged to update.
@@ -491,6 +513,7 @@ This is a major update with significant bug fixes, new features, and modernised
 
 * Ability to assign custom statuses to posts.
 
+[0.11.1]: https://github.com/Automattic/Edit-Flow/compare/0.11.0...0.11.1
 [0.11.0]: https://github.com/Automattic/Edit-Flow/compare/0.10.4...0.11.0
 [0.10.4]: https://github.com/Automattic/Edit-Flow/compare/0.10.3...0.10.4
 [0.10.3]: https://github.com/Automattic/Edit-Flow/compare/0.10.2...0.10.3

README.md

@@ -5,8 +5,8 @@ Donate link: http://editflow.org/contribute/
 Tags: workflow, editorial, editorial calendar, custom status, newsroom  
 Requires at least: 6.4  
 Requires PHP: 7.4  
-Tested up to: 6.9  
-Stable tag: 0.11.0  
+Tested up to: 7.1  
+Stable tag: 0.11.1  
 License: GPLv2 or later  
 License URI: https://www.gnu.org/licenses/gpl-2.0.html  
 

edit_flow.php

@@ -4,7 +4,7 @@
  * Plugin URI: http://editflow.org/
  * Description: Remixing the WordPress admin for better editorial workflow options.
  * Author: Daniel Bachhuber, Scott Bressler, Mohammad Jangda, Automattic, and others
- * Version: 0.11.0
+ * Version: 0.11.1
  * Requires at least: 6.4
  * Requires PHP: 7.4
  * License: GPLv2 or later
@@ -36,7 +36,7 @@ function _ef_print_php_version_admin_notice() {
 }
 
 // Define constants.
-define( 'EDIT_FLOW_VERSION', '0.11.0' );
+define( 'EDIT_FLOW_VERSION', '0.11.1' );
 define( 'EDIT_FLOW_ROOT', __DIR__ );
 define( 'EDIT_FLOW_FILE_PATH', EDIT_FLOW_ROOT . '/' . basename( __FILE__ ) );
 define( 'EDIT_FLOW_URL', plugins_url( '/', __FILE__ ) );